fix: add contents:read permission and serialize deploy comment jobs

comment-on-pr-start needs contents:read for checkout, and
deploy-and-comment must wait for it to avoid overwriting
the initial "Building..." comment.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/ci-deploy-preview.yaml

@@ -16,6 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
     permissions:
+      contents: read
       pull-requests: write
     steps:
       - name: Checkout repository
@@ -75,7 +76,7 @@ jobs:
 
   # Deploy and comment for non-forked PRs only
   deploy-and-comment:
-    needs: [build]
+    needs: [comment-on-pr-start, build]
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false && always()
     permissions: